Resubmissions
26-05-2023 11:32
230526-nng4yaff9x 710-05-2021 12:23
210510-bzkexqlwbj 810-05-2021 12:10
210510-6t4bx42gea 110-05-2021 07:49
210510-j4bf3f86pe 8Analysis
-
max time kernel
142s -
max time network
9s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
10-05-2021 07:49
Static task
static1
Behavioral task
behavioral1
Sample
6c9ed2415dc6402aeeae5abae80a20894840fc5598926721beaa13015859df1a.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
6c9ed2415dc6402aeeae5abae80a20894840fc5598926721beaa13015859df1a.exe
Resource
win10v20210408
General
-
Target
6c9ed2415dc6402aeeae5abae80a20894840fc5598926721beaa13015859df1a.exe
-
Size
56KB
-
MD5
08a2b527c9754115cd96b522912470d7
-
SHA1
b800d4fe171c48726dee92b73e91040640d9bd7b
-
SHA256
6c9ed2415dc6402aeeae5abae80a20894840fc5598926721beaa13015859df1a
-
SHA512
bc2ade2d8a3db0dd574c871e70f49a421517ef3857e8465e71bcc667fbd9e74b9e1c99480158f1648c79cd4f2e15eb7dcc7c8e5c84cafee46e14bab5b8485aa3
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Win01.exepid process 1436 Win01.exe -
Loads dropped DLL 2 IoCs
Processes:
6c9ed2415dc6402aeeae5abae80a20894840fc5598926721beaa13015859df1a.exepid process 2020 6c9ed2415dc6402aeeae5abae80a20894840fc5598926721beaa13015859df1a.exe 2020 6c9ed2415dc6402aeeae5abae80a20894840fc5598926721beaa13015859df1a.exe -
Drops file in System32 directory 3 IoCs
Processes:
6c9ed2415dc6402aeeae5abae80a20894840fc5598926721beaa13015859df1a.exeWin01.exedescription ioc process File created C:\Windows\SysWOW64\Win01.exe 6c9ed2415dc6402aeeae5abae80a20894840fc5598926721beaa13015859df1a.exe File opened for modification C:\Windows\SysWOW64\Win01.exe 6c9ed2415dc6402aeeae5abae80a20894840fc5598926721beaa13015859df1a.exe File created C:\Windows\SysWOW64\Win01.exe Win01.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
6c9ed2415dc6402aeeae5abae80a20894840fc5598926721beaa13015859df1a.exedescription pid process target process PID 2020 wrote to memory of 1436 2020 6c9ed2415dc6402aeeae5abae80a20894840fc5598926721beaa13015859df1a.exe Win01.exe PID 2020 wrote to memory of 1436 2020 6c9ed2415dc6402aeeae5abae80a20894840fc5598926721beaa13015859df1a.exe Win01.exe PID 2020 wrote to memory of 1436 2020 6c9ed2415dc6402aeeae5abae80a20894840fc5598926721beaa13015859df1a.exe Win01.exe PID 2020 wrote to memory of 1436 2020 6c9ed2415dc6402aeeae5abae80a20894840fc5598926721beaa13015859df1a.exe Win01.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c9ed2415dc6402aeeae5abae80a20894840fc5598926721beaa13015859df1a.exe"C:\Users\Admin\AppData\Local\Temp\6c9ed2415dc6402aeeae5abae80a20894840fc5598926721beaa13015859df1a.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Win01.exe"C:\Windows\system32\Win01.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\Win01.exeMD5
08a2b527c9754115cd96b522912470d7
SHA1b800d4fe171c48726dee92b73e91040640d9bd7b
SHA2566c9ed2415dc6402aeeae5abae80a20894840fc5598926721beaa13015859df1a
SHA512bc2ade2d8a3db0dd574c871e70f49a421517ef3857e8465e71bcc667fbd9e74b9e1c99480158f1648c79cd4f2e15eb7dcc7c8e5c84cafee46e14bab5b8485aa3
-
C:\Windows\SysWOW64\Win01.exeMD5
08a2b527c9754115cd96b522912470d7
SHA1b800d4fe171c48726dee92b73e91040640d9bd7b
SHA2566c9ed2415dc6402aeeae5abae80a20894840fc5598926721beaa13015859df1a
SHA512bc2ade2d8a3db0dd574c871e70f49a421517ef3857e8465e71bcc667fbd9e74b9e1c99480158f1648c79cd4f2e15eb7dcc7c8e5c84cafee46e14bab5b8485aa3
-
\Windows\SysWOW64\Win01.exeMD5
08a2b527c9754115cd96b522912470d7
SHA1b800d4fe171c48726dee92b73e91040640d9bd7b
SHA2566c9ed2415dc6402aeeae5abae80a20894840fc5598926721beaa13015859df1a
SHA512bc2ade2d8a3db0dd574c871e70f49a421517ef3857e8465e71bcc667fbd9e74b9e1c99480158f1648c79cd4f2e15eb7dcc7c8e5c84cafee46e14bab5b8485aa3
-
\Windows\SysWOW64\Win01.exeMD5
08a2b527c9754115cd96b522912470d7
SHA1b800d4fe171c48726dee92b73e91040640d9bd7b
SHA2566c9ed2415dc6402aeeae5abae80a20894840fc5598926721beaa13015859df1a
SHA512bc2ade2d8a3db0dd574c871e70f49a421517ef3857e8465e71bcc667fbd9e74b9e1c99480158f1648c79cd4f2e15eb7dcc7c8e5c84cafee46e14bab5b8485aa3
-
memory/1436-62-0x0000000000000000-mapping.dmp
-
memory/2020-59-0x0000000076281000-0x0000000076283000-memory.dmpFilesize
8KB